toga-ai 1.0.222 → 1.0.224

package/knowledge/2.0/apps/_underscore/INDEX.md

@@ -12,6 +12,6 @@
 | [NetSuite REST Client (_Component_Api_Netsuite) — record writes & SuiteQL](features/netsuite-rest-client.md) | `_Component_Api_Netsuite` is the **2.0 `_underscore` NetSuite REST client** — the shared primitive every worker2/api2 NetSuite caller uses for record GETs, Suit | _underscore/Component/Api/Netsuite/Netsuite.php |
 | [Per-Client Database Connections & the Local Logs Trap](features/per-client-database-connections.md) | When `_underscore` serves a request for a client it opens **three distinct per-client database connections**, not one. | _underscore/Database.php, _underscore/ApiRequest.php, _underscore/Model/Client/Logs/Api.php |
 | [Recursive Item Fulfillments (upstream mirroring)](features/recursive-item-fulfillments.md) | In a multi-tier supply chain a sales order (SO) spawns a purchase order (PO) that becomes another SO downstream, and so on. | _underscore/Model/Client/ItemFulfillment.php, _underscore/Model/Client/ItemFulfillmentItem.php, _underscore/Model/Client/ItemFulfillmentItemUnit.php, _underscore/Model/Client/ItemFulfillmentPackage.php, _underscore/Model/Compass/AdvanceShippingNotice.php, dbchanges2/Core/2026-02-13 - 75601 - RecursiveItemFulfillmentCreation.sql, dbchanges2/Core/2026-06-04 - RecursiveItemFulfillmentPut.sql |
-| [Surface Resolver (_Model_Core_Surface::resolve — replaces Page::meta)](features/surface-resolver.md) | The runtime for the platform-wide **Surface** UI presentation layer: 9 `_underscore` models plus a cached resolver, `_Model_Core_Surface::resolve(&$api, string | _underscore/Model/Core/Surface.php, _underscore/Model/Core/SurfaceElement.php, _underscore/Model/Core/Action.php, _underscore/Model/Core/Vocabulary.php, _underscore/Model/Core/VocabularyTerm.php, _underscore/Model/Core/Message.php, _underscore/Model/Client/SurfaceOverride.php, _underscore/Model/Client/MessageTranslation.php, _underscore/Model/Client/ThemeToken.php, _underscore/Model/Core/Page.php |
+| [Surface Resolver (_Model_Core_Surface::resolve — replaces Page::meta)](features/surface-resolver.md) | The runtime for the platform-wide **Surface** UI presentation layer: 9 `_underscore` models plus a cached resolver, `_Model_Core_Surface::resolve(&$api, string | _underscore/Model/Core/Surface.php, dbchanges2/Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql, _underscore/Model/Core/SurfaceElement.php, _underscore/Model/Core/Action.php, _underscore/Model/Core/Vocabulary.php, _underscore/Model/Core/VocabularyTerm.php, _underscore/Model/Core/Message.php, _underscore/Model/Client/SurfaceOverride.php, _underscore/Model/Client/MessageTranslation.php, _underscore/Model/Client/ThemeToken.php, _underscore/Model/Core/Page.php |
 | [Tracking-Number Bridge Migration (ASN / Item Fulfillment / Item Receipt)](features/tracking-number-bridges.md) | Shipment tracking numbers used to live as **scalar FK columns** (`trackingNumberId`, `returnTrackingNumberId`) directly on the lowest-level "unit"/"item" tables | api2/Component/Api/V2/V2.php, _underscore/Model/Client/AdvanceShippingNoticeItemUnit.php, _underscore/Model/Client/AdvanceShippingNoticeItemUnits/TrackingNumber.php, _underscore/Model/Client/ItemFulfillmentItemUnits/TrackingNumber.php, _underscore/Model/Client/ItemFulfillment.php, _underscore/Model/Prudential/AdvanceShippingNotice.php, _underscore/Model/Compass/AdvanceShippingNotice.php, _underscore/Trait/Netsuite/ItemFulfillment.php, api2/Component/Api/Cxml/Cxml.php, dbchanges2/Client/2026-06-10 - TrackingNumberBridges.sql, dbchanges2/Core/2026-06-10 - TrackingNumberBridges.sql, dbchanges2/Client_Prudential/2026-06-15 - ItemFulfillmentTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Quad/2026-06-18a - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Nychh/2026-06-19b - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Nychh/2026-06-19a - FixItemFulfillmentTableViewTrackingAndRoot.sql, dbchanges2/Client_Quad/2026-06-19a - FixItemFulfillmentTableViewTrackingAndRoot.sql |
 | [Units for Items for Purchase Orders — Data Structure](features/units-for-items-for-purchase-orders.md) | Describes how unit (serialized inventory) data is linked to sales-order and purchase-order line items behind the `units-for-items-for-purchase-orders` TableView |  |

package/knowledge/2.0/apps/_underscore/architecture.md

@@ -6,7 +6,7 @@ project: _Underscore
 client: shared
 type: architecture
 status: active
-updated: 2026-06-25
+updated: 2026-06-29
 owners: ["jcardinal", "rgirish"]
 files:
   - _underscore/_underscore.php
@@ -71,7 +71,7 @@ Tier-1 trivial declarative rules (frozen `all/any/none + {field,op,value}` gramm
 client-side; Tier-2 business logic computed in PHP returning booleans (lives in
 `_Model_<Client>_*` overrides + interceptors). Config/logic boundary: **config describes,
 PHP decides.** M2M-safe delivery via opt-in `surface=<slug>` request option → response
-`meta.surface`, never `data`. Generic FE machinery destined for `@agilant/toga-blox`.
+`meta.surface`, never `data`. Generic FE machinery destined for `@agilant/toga-blox`. **Surface is the enforced presentation path — no feature flag.** The `SURFACE_ENABLED`/`VITE_SURFACE_ENABLED` flag and all legacy pre-Surface fallback branches were removed; legacy per-screen FIELDS config is deleted as each screen migrates (no dual-path fallback). The meta endpoint is query-string form: `GET /v2/surfaces/meta?slug=<slug>`.
 
 **Rejected alternatives:** a generic EAV settings cascade (the old `*Settings` tables —
 proven near-empty in prod); raw-CSS-in-config (the old "Dummy Fields" anti-pattern).
@@ -80,7 +80,7 @@ proven near-empty in prod); raw-CSS-in-config (the old "Dummy Fields" anti-patte
 allowlist that throws on unknown ops, with a CI test asserting the op-set; defensive
 resolver with logged fallbacks; debug-bundle endpoint ships WITH the resolver; `c_longValue`
 on overrides with strict per-attribute casting; per-surface meta() cutover with a parity
-diff (do NOT delete meta() until every page is migrated); `BLANK_CLIENT_DATABASE` as a CI gate.
+diff (do NOT delete meta() until every page is migrated); `BLANK_CLIENT_DATABASE` as a CI gate. Reserved Core id blocks: `Records` 333–341, `RecordFields` 2246–2433 (renumbered 2026-06-29, seed files only — a known file-vs-DB id drift in already-provisioned envs, to reconcile by re-provisioning). Anything spanning both id schemes must be id-agnostic (match by `route=`, not id).
 
 ## Naming convention & autoloader
 
@@ -324,3 +324,4 @@ multi-file UI components (`.php`/`.html`/`.css`/`.js`) invoked as `<_ComponentNa
 ## Change history
 - 2026-06-11 — Documented lazy transaction gotcha in `_Database::register()` (rgirish)
 - 2026-06-25 — Added the Surface platform UI presentation/configuration layer (DB-driven UI config replacing `Page::meta()`, CTO-reviewed AGREE-WITH-ADJUSTMENTS) (jcardinal)
+- 2026-06-29 — Surface made the enforced (un-flagged) presentation path; reserved id blocks renumbered to Records 333–341 / RecordFields 2246–2433 (known seed-vs-provisioned drift). (jcardinal)

package/knowledge/2.0/apps/_underscore/features/surface-resolver.md

@@ -6,10 +6,11 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-06-25
+updated: 2026-06-29
 owners: [jcardinal]
 files:
   - _underscore/Model/Core/Surface.php
+  - dbchanges2/Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql
   - _underscore/Model/Core/SurfaceElement.php
   - _underscore/Model/Core/Action.php
   - _underscore/Model/Core/Vocabulary.php
@@ -30,8 +31,9 @@ related:
 The runtime for the platform-wide **Surface** UI presentation layer: 9 `_underscore` models plus a
 cached resolver, `_Model_Core_Surface::resolve(&$api, string $slug)`, that merges base config +
 cascade overrides + ACL + messages + theme tokens into one flat, serializable bundle. It is the
-**replacement for `_Model_Core_Page::meta()`** and is shipped as a scripted-API method behind
-`GET /v2/surfaces/{slug}/meta`. Platform/shared — not client-specific. Schema:
+**replacement for `_Model_Core_Page::meta()`** and is shipped as a scripted-API method called as
+`GET /v2/surfaces/meta?slug=<slug>` (RecordScript args come from the **query string**, not the
+path — see gotchas). Platform/shared — not client-specific. Schema:
 [surface-layer-schema](../../dbchanges2/features/surface-layer-schema.md).
 
 ## The 9 models
@@ -62,8 +64,8 @@ Inputs come from `$api` (the same accessor `_Model_Client_TableView::meta` uses)
    table pipeline (referenced, never duplicated).
 7. Assemble the flat bundle. **Zero INSERTs.**
 
-A `debug()` inspector returns the resolved bundle plus the raw cascade layers (shipped with the
-resolver, not "later").
+A `metaDebug()` inspector returns the resolved bundle plus the raw cascade layers (shipped with the
+resolver, not "later"). It is **not** named `debug()` — see gotchas.
 
 ## Caching & invalidation
 
@@ -97,8 +99,29 @@ resolver, not "later").
   falls back to sane defaults and never crashes a page. Strict per-`attribute` casting with logged
   fallback on bad `SurfaceOverrides` data.
 - **Cross-DB reads are batched** (DB_CORE vs DB_CLIENT) and FKs are soft — tolerate dangling refs.
+- **A scripted-API method MUST NOT collide with a non-static `_Model` base method.** Naming the
+  inspector `debug()` caused a fatal *"Cannot make non static method _Model::debug() static"* — the
+  framework base `_Model` defines a NON-static `debug()` (Model.php:167) and the scripted-API
+  dispatch calls the method statically. Renamed to `metaDebug` and remapped the RecordScript
+  (`route 'debug' → phpMethod 'metaDebug'`). Vet any new scripted-API method name against the
+  `_Model` base (e.g. `debug`, and check others) before mapping it.
+- **The endpoint is `GET /v2/surfaces/meta?slug=<slug>`, not `/v2/surfaces/<slug>/meta`.** TOGA
+  RecordScripts read their args from the **query string**; the path form makes the engine parse the
+  slug as a record uuid and return 404 EV-6. Pattern for any RecordScript:
+  `/<route>/<scriptRoute>?<arg>=...`.
+- **Core metadata records exposed to the app must grant CORE role Public (id 1) READ.** The meta
+  RecordScript is ACL-gated on the `surfaces` Core record, and authenticated app users carry CORE
+  role Public(1); a seed that grants only Super User(3)/Base(4) returns 403 EZ-1. Grant Public(1)
+  `allowRead` on the `surfaces` record (full AclRecordPermissions → AclLogicGroups →
+  AclLogicGroupExpressions → AclRecordExpressions 'all' chain), mirroring how `apps`/`records`/
+  `record-fields` already expose Public READ. Only the `surfaces` record gets Public read — the
+  admin-CRUD sibling records stay Super-User-only (the resolver reads their tables server-side).
 
 ## Change history
-- 2026-06-25 — Built the 9 models + `resolve()`/`debug()` as the cached, parameterized,
+- 2026-06-29 — Deploy fixes: renamed the scripted inspector `debug()`→`metaDebug()` (name collided
+  with non-static `_Model::debug()`, fatal); corrected the endpoint to query-string form
+  `GET /v2/surfaces/meta?slug=` (path form 404'd EV-6); granted CORE Public(1) READ on the `surfaces`
+  record so app users stop getting 403 EZ-1 on meta (id-agnostic migration matches by `route='surfaces'`). (jcardinal)
+- 2026-06-25 — Built the 9 models + `resolve()`/`metaDebug()` as the cached, parameterized,
   zero-write-on-read replacement for `_Model_Core_Page::meta()`; cache-bust interceptors on all 9
   models (outside the transaction). meta() retained until per-page cutover with parity diff. (jcardinal)

package/knowledge/2.0/apps/api2/features/surface-meta-option.md

@@ -6,7 +6,7 @@ project: API
 client: shared
 type: feature
 status: active
-updated: 2026-06-25
+updated: 2026-06-29
 owners: [jcardinal]
 files:
   - api2/Component/Api/V2/V2.php
@@ -42,6 +42,17 @@ traffic), behavior is **byte-for-byte unchanged** — pure data, zero extra work
   the logic.
 - **One call, no extra round-trip** — the state pass rides the existing data fetch.
 
+## Gotchas
+
+- **Meta endpoint 403 EZ-1 for normal app users → grant CORE Public(1) READ on the `surfaces`
+  record.** Authenticated app users carry CORE role Public (id 1); the meta RecordScript is
+  ACL-gated on the `surfaces` Core record, and a seed granting only Super User(3)/Base(4) rejects
+  them. Grant Public(1) `allowRead` on `surfaces` only (the admin-CRUD sibling records stay
+  Super-User-only — the resolver reads their tables server-side). See
+  [surface-resolver](../../_underscore/features/surface-resolver.md) gotchas for the full chain.
+
 ## Change history
+- 2026-06-29 — Documented the meta-endpoint ACL: normal app users (CORE Public role 1) need
+  `allowRead` on the `surfaces` record or meta returns 403 EZ-1. (jcardinal)
 - 2026-06-25 — Added the `surface=<slug>` opt-in option to the V2 engine; attaches per-record action
   state under `meta.surface` (M2M-safe, defensive, absent = unchanged). (jcardinal)

package/knowledge/2.0/apps/dbchanges2/INDEX.md

@@ -3,5 +3,5 @@
 | Doc | Summary | Files |
 |-----|---------|-------|
 | [Database Changes (dbchanges2) Repository Architecture](architecture.md) | `dbchanges2` is the **schema-migration / SQL change-set repository** for the entire 2.0 platform. | Core/, Client/, Client_<Tenant>/, Logs/, Logs_Client/, _modules/ |
-| [Surface Layer Schema (UI presentation/config tables)](features/surface-layer-schema.md) | The persistent schema for the platform-wide **Surface** UI presentation/configuration layer (see the `_underscore` [surface-resolver](../../_underscore/features | dbchanges2/Core/2026-06-25a - SurfaceCoreTables.sql, dbchanges2/Core/2026-06-25b - SurfaceRecordsAndFields.sql, dbchanges2/Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql, dbchanges2/Client/2026-06-25a - SurfaceClientTables.sql, dbchanges2/Client/2026-06-25b - SurfaceClientSeed.sql, dbchanges2/Client/2026-06-25c - SurfaceClientAcl.sql, dbchanges2/Client/2026-06-03- BLANK_CLIENT_DATABASE.sql |
+| [Surface Layer Schema (UI presentation/config tables)](features/surface-layer-schema.md) | The persistent schema for the platform-wide **Surface** UI presentation/configuration layer (see the `_underscore` [surface-resolver](../../_underscore/features | dbchanges2/Core/2026-06-25a - SurfaceCoreTables.sql, dbchanges2/Core/2026-06-25b - SurfaceRecordsAndFields.sql, dbchanges2/Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql, dbchanges2/Core/2026-06-29a - ItemsSurfaceSeed.sql, dbchanges2/Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql, dbchanges2/Client/2026-06-25a - SurfaceClientTables.sql, dbchanges2/Client/2026-06-25b - SurfaceClientSeed.sql, dbchanges2/Client/2026-06-25c - SurfaceClientAcl.sql, dbchanges2/Client/2026-06-03- BLANK_CLIENT_DATABASE.sql |
 | [2.0 New-Client Onboarding (manual process)](workflows/client-onboarding.md) | How to manually stand up a new 2.0 client (tenant). | Client/, Client_<Tenant>/, Core/, Logs_Client/ |

package/knowledge/2.0/apps/dbchanges2/features/surface-layer-schema.md

@@ -6,12 +6,14 @@ project: Database Changes
 client: shared
 type: feature
 status: active
-updated: 2026-06-25
+updated: 2026-06-29
 owners: [jcardinal]
 files:
   - dbchanges2/Core/2026-06-25a - SurfaceCoreTables.sql
   - dbchanges2/Core/2026-06-25b - SurfaceRecordsAndFields.sql
   - dbchanges2/Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql
+  - dbchanges2/Core/2026-06-29a - ItemsSurfaceSeed.sql
+  - dbchanges2/Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql
   - dbchanges2/Client/2026-06-25a - SurfaceClientTables.sql
   - dbchanges2/Client/2026-06-25b - SurfaceClientSeed.sql
   - dbchanges2/Client/2026-06-25c - SurfaceClientAcl.sql
@@ -60,11 +62,13 @@ SurfaceElements`). Core migrations run first; Client after. The session built/se
 **SalesOrders + login** vertical (not Tickets) as the review proof:
 
 - `Core/2026-06-25a - SurfaceCoreTables.sql` — the 6 Core tables.
-- `Core/2026-06-25b - SurfaceRecordsAndFields.sql` — `Core.Records`+`RecordFields` for all 9 tables (reserved id block **2300–2399**; `recordId` via `model=` subselect).
+- `Core/2026-06-25b - SurfaceRecordsAndFields.sql` — `Core.Records`+`RecordFields` for all 9 tables (`Records` ids **333–341**, `RecordFields` ids **2246–2433**; `recordId` via `model=` subselect). Also maps the meta `RecordScript` `route 'debug' → phpMethod 'metaDebug'` (the inspector cannot be named `debug` — see [surface-resolver](../../_underscore/features/surface-resolver.md)).
 - `Core/2026-06-25c - SalesOrderLoginSurfaceSeed.sql` — Core seed + the `RecordScripts` resolve row.
+- `Core/2026-06-29a - ItemsSurfaceSeed.sql` — the Items LIST screen seed: surfaces `items-list` (TABLE → existing `items` TableView id 9, recordId 21) + `items-list-actions` (BUTTON_BAR: refresh/columns/newItem) + Actions + ~11 Messages. Single DEFAULT bundle, no Client overrides.
+- `Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql` — grants CORE role Public(1) `allowRead` on the `surfaces` record (so app users stop getting 403 EZ-1 on meta). **Id-agnostic**: matches the record by `route='surfaces'`, so it works whether the record id is 333 or the legacy 2300.
 - `Client/2026-06-25a - SurfaceClientTables.sql` — the 3 Client tables + `INSERT IGNORE Languages('en','English')`.
 - `Client/2026-06-25b - SurfaceClientSeed.sql` — `ThemeTokens` + `MessageTranslations(en)`.
-- `Client/2026-06-25c - SurfaceClientAcl.sql` — full ACL chain for the 3 CLIENT-aclDatabase records.
+- `Client/2026-06-25c - SurfaceClientAcl.sql` — full ACL chain for the 3 CLIENT-aclDatabase records (recordId refs updated to the 333-block renumber).
 
 ## Gotchas
 
@@ -79,12 +83,22 @@ SurfaceElements`). Core migrations run first; Client after. The session built/se
 - **`SurfaceOverrides.value` is a stringly-typed escape hatch** — a long `CONFIG`/label override
   would silently truncate at varchar(255); that is why `c_longValue mediumtext` exists, and the
   resolver MUST cast strictly per `attribute` (bool/int/string/json) with a logged fallback.
-- **Reserved id block 2300–2399** for the Surface `Records`/`RecordFields` rows (Core max was 331);
-  use `model=` subselects for `recordId`, never hardcoded ids.
+- **Reserved id blocks (renumbered 2026-06-29):** Surface `Core.Records` ids **333–341** (9 tables),
+  `Core.RecordFields` ids **2246–2433**. (Originally seeded at 2300–2308 / 2400+, renumbered at the
+  team's request.) `RecordScripts.recordId` and the Core+Client ACL `recordId` refs were updated to
+  match. Use `model=` subselects for `recordId`, never hardcoded ids.
+- **Known file-vs-DB id drift.** The renumber changed the **seed files only** — already-provisioned
+  envs still hold the old 2300/2400 ids. This is intentional/known, to be reconciled by
+  re-provisioning later. Anything that must work across both (e.g. the Public-READ ACL grant) must
+  be **id-agnostic** — match the record by `route='surfaces'`, not by id.
 - **CLIENT-aclDatabase records** (`SurfaceOverrides`, `MessageTranslations`, `ThemeTokens`) need the
   full 4-step ACL chain + field permissions in **each** client DB; resolve `roleId` by subselect.
 
 ## Change history
-- 2026-06-25 — Initial schema for the Surface layer: 6 Core + 3 Client tables, `Records`/`RecordFields`
-  (ids 2300–2399), SalesOrders+login seed, ACL chain, and `BLANK_CLIENT_DATABASE` append. Typed
+- 2026-06-29 — Renumbered the reserved seed id blocks (Records 2300-2308→**333–341**, RecordFields
+  2400+→**2246–2433**) in the seed files only — known file-vs-DB drift in provisioned envs. Added
+  the Items LIST seed (`ItemsSurfaceSeed.sql`) and the id-agnostic CORE Public(1) READ ACL grant on
+  `surfaces` (`SurfaceMetaPublicReadAcl.sql`, matches by `route='surfaces'`). (jcardinal)
+- 2026-06-25 — Initial schema for the Surface layer: 6 Core + 3 Client tables, `Records`/`RecordFields`,
+  SalesOrders+login seed, ACL chain, and `BLANK_CLIENT_DATABASE` append. Typed
   columns chosen over EAV (the old `*Settings` cascade was empirically near-empty in prod). (jcardinal)

package/knowledge/2.0/apps/talos/INDEX.md

@@ -7,4 +7,5 @@
 | [Deployment — Docker, Compose, Entrypoint, External PG/Redis](features/deployment.md) | TOGa IQ ships as a **single container** (`aegra` service) wrapping the `aegra-api` FastAPI server. | talos/docker-compose.yml, talos/deployments/docker/Dockerfile, talos/deployments/docker/entrypoint.sh |
 | [MCP Servers — clickup-mcp and toga-db-mcp](features/mcp-servers.md) | Two internal **FastMCP** servers exposed over **HTTP** with API-key auth and PM2 process management: - **`clickup-mcp`** — ClickUp workspace surface (spaces / f | talos/mcp-servers/clickup-mcp/src, talos/mcp-servers/clickup-mcp/ecosystem.config.js, talos/mcp-servers/clickup-mcp/ecosystem.dev.config.js, talos/mcp-servers/clickup-mcp/pyproject.toml, talos/mcp-servers/clickup-mcp/.env.example, talos/mcp-servers/toga-db-mcp/src, talos/mcp-servers/toga-db-mcp/clusters.yaml, talos/mcp-servers/toga-db-mcp/ecosystem.config.js, talos/mcp-servers/toga-db-mcp/pyproject.toml, talos/mcp-servers/toga-db-mcp/.env.example |
 | [Observability — Langfuse, OTEL, Prometheus, OneUptime](features/observability.md) | TOGa IQ uses **two complementary tracing planes** plus optional Prometheus metrics and external uptime monitoring: - **Langfuse (native v3 SDK)** — LLM-shaped t | talos/libs/aegra-api/src/aegra_api/observability/__init__.py, talos/libs/aegra-api/src/aegra_api/observability/setup.py, talos/libs/aegra-api/src/aegra_api/observability/base.py, talos/libs/aegra-api/src/aegra_api/observability/langfuse_provider.py, talos/libs/aegra-api/src/aegra_api/observability/langfuse_client.py, talos/libs/aegra-api/src/aegra_api/observability/otel.py, talos/libs/aegra-api/src/aegra_api/observability/metrics.py, talos/libs/aegra-api/src/aegra_api/observability/span_enrichment.py, talos/libs/aegra-api/src/aegra_api/observability/targets |
+| [Pricing & COGS Model (Talos / TOGa IQ Pricing Calculator)](features/pricing-cogs-model.md) | The cost basis and pricing methodology for selling Talos (TOGa IQ) chat and voice deployments. |  |
 | [talos_agent — LangGraph ReAct Agent with Plan, BLP, MCP, Canvas](features/talos-agent.md) | `talos_agent` is the **reference LangGraph agent** shipped under `agents/talos_agent/`. | talos/agents/talos_agent/graph.py, talos/agents/talos_agent/state.py, talos/agents/talos_agent/context.py, talos/agents/talos_agent/prompts.py, talos/agents/talos_agent/tool_router.py, talos/agents/talos_agent/model_helpers.py, talos/agents/talos_agent/config/context.py, talos/agents/talos_agent/config/model_config.py, talos/agents/talos_agent/config/tool_config.py, talos/agents/talos_agent/config/plan_config.py, talos/agents/talos_agent/config/memory_config.py, talos/agents/talos_agent/config/mcp_config.py, talos/agents/talos_agent/config/blp_config.py, talos/agents/talos_agent/config/interrupt_config.py, talos/agents/talos_agent/config/artifact_config.py, talos/agents/talos_agent/plan/planner.py, talos/agents/talos_agent/plan/nodes.py, talos/agents/talos_agent/llm/system_prompt.py, talos/agents/talos_agent/llm/tool_binding.py, talos/agents/talos_agent/llm/message_ops.py, talos/agents/talos_agent/mcp/client.py, talos/agents/talos_agent/mcp/security.py, talos/agents/talos_agent/mcp/session_manager.py, talos/agents/talos_agent/blp/registry.py, talos/agents/talos_agent/blp/embedder.py, talos/agents/talos_agent/blp/nodes.py, talos/agents/talos_agent/tools/__init__.py, talos/agents/talos_agent/tools/code_interpreter.py, talos/agents/talos_agent/tools/canvas.py, talos/agents/talos_agent/tools/knowledge_base.py, talos/agents/talos_agent/tools/skill_injector.py, talos/agents/talos_agent/thread_name/nodes.py |

package/knowledge/2.0/apps/talos/features/pricing-cogs-model.md

@@ -0,0 +1,153 @@
+---
+title: Pricing & COGS Model (Talos / TOGa IQ Pricing Calculator)
+framework: "2.0"
+repo: talos
+project: TOGa IQ
+client: shared
+type: feature
+status: active
+updated: 2026-06-29
+owners: [jcardinal]
+files: []
+related:
+  - ../architecture.md
+  - aegra-api.md
+  - observability.md
+---
+
+## Summary
+
+The cost basis and pricing methodology for selling Talos (TOGa IQ) chat and
+voice deployments. The deliverable is a **per-client Excel workbook — TALOS
+Pricing Calculator v9** (replaces v8) — that lives on the team's shared AI drive
+(under `P:\Work\AI\`), **not** in any repo. This doc captures the durable
+knowledge: the cost drivers, measured production rates, and the pricing
+decisions, so anyone can re-price Talos without re-deriving the model.
+
+There is no Talos source code behind this — it is a sales/finance model. Treat
+the numbers below as the **April 2026 baseline**; re-measure before relying on
+them in a later period.
+
+## Chat COGS model
+
+Chat AI cost is driven primarily by **LLM tokens on Amazon Bedrock**.
+
+### Bedrock token rates (per 1M tokens)
+
+| Token class | Rate |
+|---|---|
+| Fresh input | $3.00 |
+| Cached-instruction read | $0.30 |
+| Cache write | $3.75 |
+| Output | $15.00 |
+
+### Measured per-exchange production averages
+
+Source: tenant DB, April 2026, ~3,610 exchanges.
+
+| Metric | Tokens / exchange |
+|---|---|
+| Cached instructions | 15,013 |
+| Cache write | 2,830 |
+| Output | 527 |
+
+### Per-feature token adders (measured)
+
+| Feature | Tokens per use | Sample size |
+|---|---|---|
+| Document search | 4,747 / search | 542 searches |
+| Web search | 765 / search | 120 searches |
+| Code execution | 205 / run | 929 runs |
+| App action | 1,086 / action | 71 actions |
+
+**Assumed feature occurrences per conversation:** document search 2, web search
+1, code execution 2, app actions 5 **per connected app**.
+
+### Compute and fixed infrastructure
+
+- **Code session compute** — Bedrock AgentCore ~$0.05 / session; ~80% of
+  code-enabled conversations trigger a session.
+- **Platform / hosting** — $910 / month fixed.
+- **Document-search index** — OpenSearch Serverless, +$350 / month, charged
+  **only when Document Search is enabled**.
+
+### Conversation model constants (v8/v9 engine)
+
+- System overhead: 200 tokens / conversation
+- Base fresh: 727 tokens / exchange
+- History accumulation factor: ×7
+- Exchanges per conversation: 15
+
+> **Gotcha (flagged for technical review):** history accumulates over ×7 but
+> the per-exchange cost is multiplied by 15 exchanges. This mismatch is a known
+> quirk, **preserved as-is in v9 for number parity with v8** — do not "fix" it
+> silently, as it would change every quoted price. See Change history.
+
+### Measured cost-per-exchange benchmarks by assistant type (April 2026)
+
+| Assistant type | Cost / exchange |
+|---|---|
+| Contact Centre | $0.0223 |
+| HR / Compliance | $0.0354 |
+| General Purpose | $0.0435 |
+| Sales / CRM | $0.0829 |
+| Technical / Data-heavy | $0.1139 |
+| Enterprise heavy | $0.1261 |
+
+## Voice COGS model
+
+Talos Voice (voice-to-voice) is priced **per minute**. It uses the AWS STT/TTS
+approach. Per-minute drivers:
+
+| Driver | Rate / basis |
+|---|---|
+| LiveKit | $50/mo plan incl. 5,000 min; $0.01/min overage |
+| Amazon Transcribe (STT) | $0.024 / min |
+| Amazon Polly Generative (TTS) | $30 / 1M chars at ~400 chars/min |
+| LLM tokens | ~800 fresh, ~5,000 cached, ~300 output per minute, at the chat token rates above |
+| S3 recording storage | $0.023 / GB-mo at ~0.5 MB/min over the retention window |
+
+## Pricing methodology (decision)
+
+Adopted to **reduce client-facing price fluctuation while protecting margin**:
+
+1. **Two-part price.** Client pays a **flat monthly org fee** PLUS a **fixed
+   monthly per-user fee**. The per-user fee is a stable rate-card value and does
+   **not** change.
+2. **Margin band.** Sales sets a min and max gross-margin band. The recommended
+   flat fee is solved so projected margin lands at the **midpoint** of the band:
+
+   ```
+   flat = COGS / (1 - mid_margin) - per_user_fee * users     (floored at 0)
+   ```
+3. **Smoothing rule.** Actual COGS is tracked monthly per client. The flat fee
+   is changed **only after** actual margin sits outside the band for a
+   configurable number of **consecutive** months (**default 3**). The per-user
+   fee is **never** adjusted.
+
+### Workbook structure (TALOS Pricing Calculator v9)
+
+| Tab | Purpose |
+|---|---|
+| Sales | Rep-facing inputs + recommended flat fee + min/mid/max margin-band options |
+| Voice | Per-minute band pricing |
+| Technical | Single source of truth for all raw rates — sales never edits |
+| Actuals | Monthly actual-AWS-COGS entry, margin-vs-band status, consecutive-breach flags, suggested mid-band flat fee |
+| Engine | Hidden calculation engine |
+
+The workbook is a **per-client** file on the shared AI drive (`P:\Work\AI\`).
+
+## Gotchas / known issues
+
+- **Numbers are an April 2026 baseline.** Token rates, AWS prices, and measured
+  per-exchange averages drift — re-measure from the tenant DB before quoting in
+  a later period.
+- **History ×7 vs. ×15 exchanges quirk** (see Chat model) — intentional parity
+  hack, not a bug to silently correct.
+- **OpenSearch +$350/mo is conditional** — only counts when Document Search is
+  enabled; do not bake it into every quote.
+- **Do not embed the absolute drive path as canonical** — the calculator lives
+  under the team shared AI drive; the path can move.
+
+## Change history
+- 2026-06-29 — Initial pricing/COGS model doc: chat token + feature drivers, voice per-minute drivers, two-part flat+per-user methodology with mid-band solve and consecutive-month smoothing. Captured from TALOS Pricing Calculator v9 (replaces v8). v9 verified to reproduce v8 exactly ($0.811182/conversation, $2,071.18/mo for 50 users × 20 conversations, Document Search only). History ×7 vs ×15-exchanges quirk preserved for parity and flagged for technical review. (jcardinal)

package/knowledge/2.0/apps/toga25-supply/INDEX.md

@@ -8,4 +8,4 @@
 | [Column Visibility (URL-driven show/hide columns)](features/column-visibility.md) | A "Columns" header button that opens a modal listing every column from the table meta, lets the user show/hide columns, adjusts the table live, and persists the | toga25-supply/src/components/ColumnVisibilityModal/, toga25-supply/src/pages/SalesOrders/SalesOrders.tsx, toga25-supply/src/pages/SalesOrders/viewModel/useSalesOrdersPageViewModel.tsx, toga25-supply/src/pages/SalesOrders/hooks/useSalesOrdersTableData.tsx |
 | [Meta-Driven Page & Table Setup](features/meta-driven-table-data.md) | A page in this app is **meta-driven end to end**: the page view model fetches *page meta* (labels, sections, ACL) and *table meta* (the columns/fields + table s | toga25-supply/src/pages/SalesOrders/viewModel/useSalesOrdersPageViewModel.tsx, toga25-supply/src/pages/SalesOrders/hooks/useSalesOrdersTableState.ts, toga25-supply/src/hooks/useTablePageMeta.ts, toga-blox-npm/dist/hooks/useFetchPageMeta.d.ts, toga-blox-npm/dist/hooks/useFetchTablePageMeta.d.ts, toga-blox-npm/dist/hooks/useAssignTableFieldLabels.d.ts, toga-blox-npm/dist/components/Table/hooks/useTableData.d.ts |
 | [Record Modals & Nested Tables](features/record-modals-and-nested-tables.md) | The repo's family of modal + nested-table patterns layered over toga-blox `TableRecordModal` and `PrimaryTable*Layout`. | toga25-supply/src/layout/ItemRecordModalLayout/, toga25-supply/src/layout/SalesOrderRecordModalLayout/, toga25-supply/src/layout/SalesOrderItemsTableLayout/, toga25-supply/src/layout/ItemFulfillmentModal/, toga25-supply/src/layout/GenericNestedTables/, toga25-supply/src/hooks/useTableCellInteractions.ts |
-| [Surface Frontend (DB-driven UI consumption, src/surface/)](features/surface-frontend.md) | The frontend consumer of the platform-wide Surface layer — DB-driven UI config fetched from `GET /v2/surfaces/{slug}/meta` instead of statically-imported JSON f | toga25-supply/src/surface/useFetchSurfaceMeta.ts, toga25-supply/src/surface/evaluateSurfaceRule.ts, toga25-supply/src/surface/actionRegistry.ts, toga25-supply/src/surface/SurfaceActionBar.tsx, toga25-supply/src/surface/SurfaceSection.tsx, toga25-supply/src/surface/resolve.ts, toga25-supply/src/surface/types.ts, toga25-supply/src/surface/featureFlag.ts, toga25-supply/src/surface/index.ts, toga25-supply/src/pages/Login/LoginPage.tsx, toga25-supply/src/pages/SalesOrders/SalesOrders.tsx, toga25-supply/src/pages/SalesOrders/view/SalesOrderRecordModalLayout/view/sections/SalesOrderTopBar.tsx |
+| [Surface Frontend (DB-driven UI consumption, src/surface/)](features/surface-frontend.md) | The frontend consumer of the platform-wide Surface layer — DB-driven UI config fetched from `GET /v2/surfaces/meta?slug=<slug>` instead of statically-imported J | toga25-supply/src/surface/useFetchSurfaceMeta.ts, toga25-supply/src/surface/evaluateSurfaceRule.ts, toga25-supply/src/surface/actionRegistry.ts, toga25-supply/src/surface/SurfaceActionBar.tsx, toga25-supply/src/surface/SurfaceSection.tsx, toga25-supply/src/surface/resolve.ts, toga25-supply/src/surface/types.ts, toga25-supply/src/surface/index.ts, toga25-supply/src/pages/Login/LoginPage.tsx, toga25-supply/src/pages/SalesOrders/SalesOrders.tsx, toga25-supply/src/pages/SalesOrders/view/SalesOrderRecordModalLayout/view/sections/SalesOrderTopBar.tsx, toga25-supply/src/pages/Items/ItemsPage.tsx, toga25-supply/src/pages/Items/viewModel/useItemsPageViewModel.tsx, toga25-supply/src/fieldsConfig/index.ts |

package/knowledge/2.0/apps/toga25-supply/features/surface-frontend.md

@@ -6,7 +6,7 @@ project: TOGa 2.5 Supply
 client: shared
 type: feature
 status: active
-updated: 2026-06-25
+updated: 2026-06-29
 owners: [jcardinal]
 files:
   - toga25-supply/src/surface/useFetchSurfaceMeta.ts
@@ -16,11 +16,13 @@ files:
   - toga25-supply/src/surface/SurfaceSection.tsx
   - toga25-supply/src/surface/resolve.ts
   - toga25-supply/src/surface/types.ts
-  - toga25-supply/src/surface/featureFlag.ts
   - toga25-supply/src/surface/index.ts
   - toga25-supply/src/pages/Login/LoginPage.tsx
   - toga25-supply/src/pages/SalesOrders/SalesOrders.tsx
   - toga25-supply/src/pages/SalesOrders/view/SalesOrderRecordModalLayout/view/sections/SalesOrderTopBar.tsx
+  - toga25-supply/src/pages/Items/ItemsPage.tsx
+  - toga25-supply/src/pages/Items/viewModel/useItemsPageViewModel.tsx
+  - toga25-supply/src/fieldsConfig/index.ts
 related:
   - ../../_underscore/features/surface-resolver.md
   - meta-driven-table-data.md
@@ -29,14 +31,17 @@ related:
 ## What it is
 
 The frontend consumer of the platform-wide Surface layer — DB-driven UI config fetched from
-`GET /v2/surfaces/{slug}/meta` instead of statically-imported JSON field bundles. Lives in
+`GET /v2/surfaces/meta?slug=<slug>` instead of statically-imported JSON field bundles. Lives in
 `src/surface/` for now with a `TODO(blox)` to extract the generic machinery into `@agilant/toga-blox`
-so all 2.0 apps inherit it. Backend: [surface-resolver](../../_underscore/features/surface-resolver.md).
+so all 2.0 apps inherit it. Surface is now the **enforced, unconditional presentation path** (no
+feature flag — see below). Backend: [surface-resolver](../../_underscore/features/surface-resolver.md).
 
 ## How it works
 
 - **`useFetchSurfaceMeta`** — the single fetch-once/React-Query-cached choke point for a surface's
-  meta. Loading a different *record* into the same surface reuses cached meta.
+  meta. Loading a different *record* into the same surface reuses cached meta. Builds the URL as
+  `/surfaces/meta?slug=...` (query string), **not** `/surfaces/<slug>/meta` (the path form makes the
+  engine parse the slug as a record uuid → 404 EV-6).
 - **`evaluateSurfaceRule`** — the Tier-1 rule evaluator: a **frozen `all/any/none` + `{field,op,value}`
   grammar** that **throws on an unknown op** (generalized from the SalesOrders
   `buildPatchedTenantFields`/`evaluateEnableRule`/`resolveFlag` helpers). Evaluated client-side against
@@ -47,25 +52,53 @@ so all 2.0 apps inherit it. Backend: [surface-resolver](../../_underscore/featur
 - **theme/message resolvers** (`resolve.ts`) — token → CSS and ICU message rendering.
 - **`SurfaceActionBar`/`SurfaceActions` + `SurfaceSection`** — generic renderers.
 
-## What's wired (review proof)
+## Enforced, not flagged
 
-Login + sales-orders list + the sales-order modal, all behind the **`SURFACE_ENABLED`** flag (env
-`VITE_SURFACE_ENABLED`, **default OFF**). The SalesOrder action bar reproduces
-`orderViewFields.json` approve/deny/approvalWorkflow/viewLog/editOrder by delegating to the existing
-`onActionClick`/`onOpenLog` handlers. The table stays on the existing TableView pipeline via
-`tableViewSlug` (see [meta-driven-table-data](meta-driven-table-data.md)) — the Surface layer
-references the TableView, never replaces it.
+Surface is the **unconditional** presentation path. The `VITE_SURFACE_ENABLED` / `SURFACE_ENABLED`
+feature flag was **removed entirely** (`featureFlag.ts` deleted, all gating conditionals and the
+legacy pre-Surface fallback branches at the wired screens removed). Legacy per-screen `FIELDS` config
++ rendering are deleted as each screen migrates — there is no dual-path fallback.
+
+## What's wired
+
+Login + sales-orders list + the sales-order modal + the **Items LIST** screen. The SalesOrder action
+bar reproduces `orderViewFields.json` approve/deny/approvalWorkflow/viewLog/editOrder by delegating
+to the existing `onActionClick`/`onOpenLog` handlers. TABLE-type surfaces stay on the existing
+TableView pipeline via `tableViewSlug` (see [meta-driven-table-data](meta-driven-table-data.md)) —
+the Surface layer references the TableView, never replaces it.
+
+## Per-screen migration recipe (proven on SalesOrders + Items)
+
+The screen-by-screen full-app refactor follows one recipe:
+1. Seed the screen's surface(s) in a `Core/*SurfaceSeed.sql` — a TABLE surface that references the
+   screen's existing `TableView` id via `tableViewSlug`, plus a BUTTON_BAR/actions surface + its
+   Actions + Messages (e.g. Items: `items-list` TABLE → TableView id 9 / recordId 21, and
+   `items-list-actions` refresh/columns/newItem).
+2. Rewire the page + its view-model to consume the surface bundle (`ItemsPage.tsx` /
+   `useItemsPageViewModel.tsx`).
+3. **Delete** the legacy `FIELDS` config: the page's `*Fields.json` and its `fieldsConfig/index.ts`
+   entries.
+Keep TABLE rendering on the existing TableView pipeline; only the chrome (actions/labels/visibility)
+moves to Surface. A screen with no client/role/lang variance ships a single DEFAULT bundle (no
+Client overrides), as Items did.
 
 ## Gotchas
 
-- **Default OFF.** Nothing renders through the Surface path unless `VITE_SURFACE_ENABLED` is set —
-  the existing JSON-bundle path remains live until per-surface cutover.
+- **No feature flag, no fallback.** Surface is the enforced path; a missing/broken surface bundle
+  does not silently fall back to legacy JSON — that path is deleted per screen as it migrates.
+- **Endpoint is query-string form** — `GET /v2/surfaces/meta?slug=...`, not `/surfaces/<slug>/meta`
+  (the path form 404s EV-6).
 - **Tier-1 only on the client.** Business-logic gates (Tier-2) arrive as resolved booleans from the
   backend (`meta.surface`); never re-encode business rules in the FE evaluator.
 - **`tsc` not yet run** this session (the private `@agilant/toga-blox` registry needs npm creds);
   treat type-checking as pending. Runtime `GET /v2/surfaces/{slug}/meta` also not yet exercised.
 
 ## Change history
+- 2026-06-29 — DECISION: Surface is now enforced, not flagged — removed `VITE_SURFACE_ENABLED`/
+  `SURFACE_ENABLED` (deleted `featureFlag.ts` + all gating/legacy-fallback branches). Fixed
+  `useFetchSurfaceMeta` to the query-string endpoint `/surfaces/meta?slug=` (path form 404'd EV-6).
+  Migrated the Items LIST screen (second proof of the per-screen recipe; deleted `itemsPageFields.json`
+  + its fieldsConfig entries). (jcardinal)
 - 2026-06-25 — Built `src/surface/` (fetch hook, frozen Tier-1 rule evaluator, action registry, theme/
   message resolvers, action-bar + section renderers); wired login + SalesOrders list + SO modal behind
   the OFF-by-default `SURFACE_ENABLED` flag. Generic machinery destined for toga-blox. (jcardinal)

package/knowledge/INDEX.md

@@ -24,7 +24,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **saml** (SAML SSO Gateway) — 3 doc(s) → [2.0/apps/saml/INDEX.md](2.0/apps/saml/INDEX.md)
 - **toga2-view** (TOGa View Frontend) — 4 doc(s) → [2.0/apps/toga2-view/INDEX.md](2.0/apps/toga2-view/INDEX.md)
 - **toga2-hub** (TOGa Hub) — 2 doc(s) → [2.0/apps/toga2-hub/INDEX.md](2.0/apps/toga2-hub/INDEX.md)
-- **talos** (TOGa IQ) — 6 doc(s) → [2.0/apps/talos/INDEX.md](2.0/apps/talos/INDEX.md)
+- **talos** (TOGa IQ) — 7 doc(s) → [2.0/apps/talos/INDEX.md](2.0/apps/talos/INDEX.md)
 - **voice-to-voice** (TOGa Voice) — 4 doc(s) → [2.0/apps/voice-to-voice/INDEX.md](2.0/apps/voice-to-voice/INDEX.md)
 - **ai-bdr** (AI-BDR) — 4 doc(s) → [2.0/apps/ai-bdr/INDEX.md](2.0/apps/ai-bdr/INDEX.md)
 - **toga2-commerce** (TOGa Commerce) — 6 doc(s) → [2.0/apps/toga2-commerce/INDEX.md](2.0/apps/toga2-commerce/INDEX.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.222",
+  "version": "1.0.224",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",